rootpwn

high · CVSS v3 7.5 · EPSS 0.00136

CVE-2026-87839

The Tripzzy WordPress plugin (v<1.5.1) lacks authorization checks on an AJAX endpoint, letting unauthenticated users delete any comment. Thi

Overview

The Tripzzy WordPress plugin (v<1.5.1) lacks authorization checks on an AJAX endpoint, letting unauthenticated users delete any comment. This flaw can erase user-generated content and disrupt site integrity. It is a high‑severity vulnerability that can be exploited without credentials.

Description

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

Impact

Confidentiality: comment data can be removed, affecting content integrity. Integrity: arbitrary comments can be deleted, undermining trust. Availability: repeated deletions could degrade user experience. Site administrators and users are impacted.

Remediation

Update the Tripzzy plugin to version 1.5.1 or later. If update not possible, disable the AJAX endpoint or remove the plugin. Monitor comment logs for unexpected deletions and restore from backups if necessary.

Risk context

Severity is high with CVSS 7.5 and EPSS 0.00136, indicating a low probability but significant impact. Defenders should treat it as a moderate to high priority patch.

Affected products

  • Tripzzy plugin

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
0.00136

WordPress plugin unauthenticated comment-deletion authorization high-severity

← All CVEs

Related CVEs

high

CVE-2026-93974

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

View analysis

high

CVE-2026-92252

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. This may disable antivirus protection or enable privileged code execution if modified binaries are loaded by an elevated WatchDog process.

View analysis

high

CVE-2026-92253

Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a quarantined file to be written to an arbitrary filesystem location by creating a directory junction at the original file path and persuading an administrator to restore the file. This may enable modification of protected files or SYSTEM-level code execution through DLL hijacking.

View analysis

high

CVE-2026-92254

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \Device\wsdk device.

View analysis